Julian Sommer
e2fb37c0ac
The coverage pages led with a percentage and an "x of y" count, and every table listed the modelled operations Spinifex does not implement, which reads as a scorecard against AWS rather than a statement of what the platform serves. A published page now opens with the operation count alone, tables the operations the gateway serves, and carries a separate not-applicable table with each reason inline instead of footnotes. The unimplemented operations and the counts move to docs/coverage/internal-report.md, which no docs-site slug points at. A service with no implemented operations has no publishable page.
title, seoTitle, description, category, sections, tags
| title | seoTitle | description | category | sections | tags | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RDS API Coverage | Relational Database Service API Coverage — Spinifex Docs | The Amazon RDS API operations Spinifex implements, for the managed PostgreSQL and MariaDB engines it offers, with those the platform does not offer and why. | Coverage |
|
|
RDS API Coverage
Overview
Spinifex implements 26 operations in the RDS 2014-10-31 API model.
Engines
Spinifex offers PostgreSQL and MariaDB. Each DB instance is one dedicated system-owned VM running the engine directly, launched from a platform AMI and hidden from the customer's EC2 API. Engine is fixed at create: there is no in-place engine change, no cross-engine snapshot restore and no migration between the two.
mysql is not an accepted engine and is not an alias for mariadb. MariaDB is offered under its own AWS engine name, exactly as AWS RDS offers it, so a client — including Terraform's aws_db_instance — must set engine = "mariadb".
Engine versions are pinned per engine. An EngineVersion naming anything but the pin is rejected, including a narrower minor version, because the AMI makes no promise about which minor it carries.
The endpoint is private
The engine is reached over a customer-account ENI injected into a subnet of the DB subnet group, so the endpoint is reachable from inside the VPC only. The DB VM has other NICs that no customer security group governs, and the engine binds none of them — the port is not open there at all, rather than open and gated.
TLS is required by default
Both engines enforce encrypted connections by default: rds.force_ssl on PostgreSQL and require_secure_transport on MariaDB. For MariaDB this is a deliberate divergence from AWS, which leaves it off. Both are boolean, modifiable and dynamic, so setting either to 0 in a parameter group restores plaintext without a reboot.
Rejected parameters
A parameter whose omission would create a false safety, security or availability guarantee is rejected with InvalidParameterValue rather than silently dropped.
| Parameter | Why it is rejected |
|---|---|
MultiAZ=true |
Single-AZ platform; a standby would not exist |
PubliclyAccessible=true |
The endpoint is a private VPC address |
StorageEncrypted=false |
Unencrypted storage is not offered |
EnableIAMDatabaseAuthentication |
IAM database authentication is not implemented |
Iops, StorageThroughput, StorageType ≠ gp3 |
Provisioned performance classes are not implemented |
KmsKeyId, TdeCredentialArn |
Storage is encrypted with the cluster key, not a customer-managed one |
AvailabilityZone |
The platform exposes a single zone |
AvailabilityZoneGroup (orderable options) |
It selects a zone or local-zone group, and naming a zone is already refused |
DBSecurityGroups |
EC2-Classic security groups — use VpcSecurityGroupIds |
DBClusterIdentifier, DBClusterSnapshotIdentifier |
Clustered engines are not offered |
EnableCloudwatchLogsExports |
Log export is not implemented |
EngineVersion other than the engine's pin, Engine on modify |
No in-place engine or version change |
Engine=mysql (and Aurora engines) |
Oracle MySQL is not offered; mariadb is a distinct engine, not an alias for it |
NewDBInstanceIdentifier |
The identifier is the DNS label and the KV key |
DBPortNumber, DBSubnetGroupName on modify |
Both would move the endpoint |
MaxAllocatedStorage |
Storage autoscaling is not implemented |
ManageMasterUserPassword, RotateMasterUserPassword |
Secrets Manager integration is not offered |
CACertificateIdentifier |
The serving certificate is minted from the cluster CA |
Domain, DomainFqdn |
Active Directory domain join is not offered |
OptionGroupName |
Option groups are not offered |
CustomIamInstanceProfile |
The DB VM's instance profile is platform-owned |
EnableCustomerOwnedIp |
An Outposts feature |
ForceFailover (reboot) |
No standby to fail over to |
DBSnapshotIdentifier (stop) |
Snapshot-on-stop is not implemented |
Operations
| Operation |
|---|
AddTagsToResource |
CreateDBInstance |
CreateDBParameterGroup |
CreateDBSnapshot |
CreateDBSubnetGroup |
DeleteDBInstance |
DeleteDBParameterGroup |
DeleteDBSnapshot |
DeleteDBSubnetGroup |
DescribeDBEngineVersions |
DescribeDBInstanceAutomatedBackups |
DescribeDBInstances |
DescribeDBParameterGroups |
DescribeDBParameters |
DescribeDBSnapshots |
DescribeDBSubnetGroups |
DescribeEvents |
DescribeOrderableDBInstanceOptions |
ListTagsForResource |
ModifyDBInstance |
ModifyDBParameterGroup |
RebootDBInstance |
RemoveTagsFromResource |
RestoreDBInstanceFromDBSnapshot |
StartDBInstance |
StopDBInstance |
Not applicable
These operations describe AWS-hosted features this platform does not offer.
| Operation | Reason |
|---|---|
CreateDBCluster |
Aurora and Multi-AZ clusters are not offered; a DB instance here is a single VM running the engine directly. |
CreateDBInstanceReadReplica |
Replication between instances is not offered, so there is no replica to create or promote. |
CreateOptionGroup |
Option groups configure engine add-ons for engines this platform does not offer, such as Oracle and SQL Server. |
DeleteDBCluster |
Aurora and Multi-AZ clusters are not offered; a DB instance here is a single VM running the engine directly. |
DeleteOptionGroup |
Option groups configure engine add-ons for engines this platform does not offer, such as Oracle and SQL Server. |
DescribeDBClusters |
Aurora and Multi-AZ clusters are not offered; a DB instance here is a single VM running the engine directly. |
DescribeOptionGroups |
Option groups configure engine add-ons for engines this platform does not offer, such as Oracle and SQL Server. |
FailoverDBCluster |
Aurora and Multi-AZ clusters are not offered; a DB instance here is a single VM running the engine directly. |
ModifyDBCluster |
Aurora and Multi-AZ clusters are not offered; a DB instance here is a single VM running the engine directly. |
ModifyOptionGroup |
Option groups configure engine add-ons for engines this platform does not offer, such as Oracle and SQL Server. |
PromoteReadReplica |
Replication between instances is not offered, so there is no replica to create or promote. |
RestoreDBInstanceToPointInTime |
Point-in-time restore needs continuous transaction-log archival, which the backup path does not keep. |